Remove stale Caddy block before rewriting it on a fresh security-dashboard reinstall

The fresh-install path called _secdash_configure_caddy directly with no
prior removal, unlike the update/reconfigure path which already calls
_secdash_remove_caddy_block first. Re-running a "Full install" over an
existing dashboard on the same domain therefore appended a second site
block instead of replacing the first — and since Caddy serves whichever
block comes first in the file, the old one (old Authelia address, old
Basic Auth settings) kept winning even after answering the prompts with
new values. Confirmed live: reconfiguring a dashboard from a local to a
remote Authelia address left the old forward_auth target still in effect
until the stale block was deleted by hand.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/security-dashboard.sh

@@ -220,6 +220,17 @@ install_security-dashboard() {
     # _secdash_configure_caddy so "update" mode can also offer to reconfigure
     # it later (e.g. to add Basic Auth to an already-deployed dashboard)
     # without duplicating this logic — see that function for the rest.
+    #
+    # Remove any existing block first — this "fresh" path re-runs on a box
+    # that already has one (a "Full install" over an existing dashboard, not
+    # just a first-time install), and without this it doesn't replace the
+    # old block, it appends a second one for the same domain. Caddy serves
+    # whichever block comes first in the file, so the stale block (old
+    # Authelia address, old Basic Auth, etc.) kept winning even after
+    # answering these prompts with new values. The update/reconfigure path
+    # below already does this (line ~173); a fresh install needs the same
+    # removal, not just the same write. No-ops if nothing is deployed yet.
+    _secdash_remove_caddy_block "$DASHBOARD_PORT"
     _secdash_configure_caddy "$DASHBOARD_PORT"
     _secdash_configure_admin_scoping "$APP_DIR" "$SVC_USER" "$DASHBOARD_PORT"